jose

JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes

Latest 6.2.12

NPM

92%

Total Score

Maintainer Stability

Maturity

100

Supply Chain

100

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Maintainers

Only one registry account, panva, has publish access. This is a concentration concern, but actual repository activity and provenance show that the package is actively maintained rather than abandoned.

Project backing

The repository is owned by the user account panva rather than an organization, so the concentrated maintainer and commit activity is not offset by explicit organizational backing. Nevertheless, the observed release and commit activity is strong.

Repo bus factor

Recent work is highly concentrated: panva made 129 of 133 commits, or about 97%, while four other contributors made one commit each. This creates a genuine continuity risk, despite the presence of five active contributors and ongoing maintenance.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-584205 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. jose is vulnerable to Improper Authentication in versions 4.14.0 - 6.2.4.	4.14.0 - 6.2.4	Low
CVE-2024-28176 jose is vulnerable to Uncontrolled Resource Consumption in versions 3.0.0 - 4.15.4 and 0.0.0 - 2.0.7.	0.0.0 - 2.0.73.0.0 - 4.15.4	Medium
CVE-2022-36083 jose is vulnerable to Uncontrolled Resource Consumption in versions 1.0.0 - 1.28.1, 2.0.0 - 2.0.5, 3.0.0 - 3.20.3 and 4.0.0 - 4.9.1.	1.0.0 - 1.28.12.0.0 - 2.0.53.0.0 - 3.20.3 +1 more	Medium
CVE-2021-29443 jose is vulnerable to Observable Discrepancy in versions 1.0.0 - 1.28.1, 2.0.0 - 2.0.5 and 3.0.0 - 3.11.4.	1.0.0 - 1.28.12.0.0 - 2.0.53.0.0 - 3.11.4	Medium